29 ms·

LTESniffer: An Open-Source LTE Downlink/Uplink Eavesdropper

256 points by transpute 2y ago

slwvx 2y ago
Nice! I see that it supports FDD only (no TDD) and is limited to 20MHz, so some limitations. I see that it can do some amount of real-time decoding, which is interesting. In cell towers, a big part of the processing is done by fairly general-purpose processors, but still much more tightly integrated with the hardware than this software is.
wkat4242 2y ago
Too bad the hardware for this is eyewateringly expensive :'(
- teruakohatu 2y ago
  Seems like if you had a PC already, you could get away with a bladeRF 2.0 micro xA5 for $670, but this can sniff downlink only.
  - wkat4242 2y ago
    Yeah for me that is already eye-wateringly expensive :) (Being in Spain where purchasing power is low).
  - fhsm 2y ago
    > xA5 for $670 No longer for sale (out of stock with no plan to restock https://www.nuand.com/product/bladerf-xa5/ https://www.nuand.com/product/bladerf-xa5/ )
- RachelF 2y ago
  Yes, there is cheaper hardware like the Adalm Pluto with enough bandwidth and dynamic range, but it is not supported by the looks of things.
- superkuh 2y ago
  For those interested in a more accessible LTE meta-data decoder check out https://github.com/JiaoXianjun/LTE-Cell-Scanner https://github.com/JiaoXianjun/LTE-Cell-Scanner which can work with even cheap rtl-sdr dongles (for some things). It is a fork of an older https://github.com/Evrytania/LTE-Cell-Scanner https://github.com/Evrytania/LTE-Cell-Scanner
  - wkat4242 2y ago
    Huh how can that work? It's only got 2Mhz bandwidth. An LTE cell is much wider.
    - dezgeg 2y ago
      Possibly it's decoding MIB only, which is only 1.080 MHz wide.
- binary_marbl 2y ago
  What does it require?
- tinix 2y ago
  It uses srsRAN which supports SoapySDR which is vendor agnostic. this should work with limesdr as well. for something cheaper, try antsdr or adalm-pluto: https://github.com/srsran/zynq_timestamping https://github.com/srsran/zynq_timestamping lots of good notes here: https://www.quantulum.co.uk/blog/private-lte-with-analog-adalm-pluto/ https://www.quantulum.co.uk/blog/private-lte-with-analog-ada...
  - wkat4242 2y ago
    I thought it needs 2xUSRP if you want to receive both sides? And it's a lot less useful without that.
    - AnarchismIsCool 2y ago
      Pluto and USRP are almost exactly the same thing at this point, just USB2 vs USB3 so you're limited on data rates outside of the device an technically a different chip but they're an old node and binned, so they're the same in practice. You can still install an external clock into the UFL connector on the Pluto though so you can sync a few if you want or use a GPSDO for frequency accuracy. You can also install the extra Tx/Rx pair onto the UFL connectors they added recently-ish.
- HeatrayEnjoyer 2y ago
  True? How are phone modems inexpensive?
  - paweladamczuk 2y ago
    I'm wondering the same thing. Can someone outline the architectural limitations of using a smartphone modem for such network debugging/sniffing tasks?
    - wkat4242 2y ago
      Smartphone modems (baseband) are super optimised for battery life. They don't send any traffic that isn't meant for the device itself on to the CPU. That would only cause unnecessary load. They could perhaps be modified to do that but the baseband firmware is usually very closed source. There is only one example I know, there was one particular dumbphone from the 2G era for which the baseband sourcecode was available due to a hack. You could use several (one for uplink and one for downlink) of these with modified firmware to sniff 2G traffic. I forget which model it was exactly but obviously the price ballooned on eBay :) Haven't heard of this happening with later models. Baseband sourcecode firmware is really rare.
      - motrm 2y ago
        Certainly Qualcomm modems can have their diagnostic mode enabled when you have access to /dev/diag - usually on rooted devices but occasionally on stock. You can ask the processor to send higher layer information via diag, including the messages the base stations send. There’s also commands to lock on to a specific base station so you’re not constantly moving from cell to cell. There’s plenty of commercial devices that use this functionality to provide network monitoring and management capabilities for mobile network operators checking out base station functionality in the field. TEMS comes to mind for that but they’re certainly not the only ones. It’s a deep rabbit hole :-)
        deleted 2y ago
        [deleted]
deleted 2y ago
[deleted]
anilakar 2y ago
Mobile network standards are full of acronyms. I love it. In case you did not know, the letter Q in PHICH stands for "request".
- derefr 2y ago
  If anyone is wondering what the parent poster is talking about — the abbreviation PHICH (which isn't mentioned in the referenced project, but is just an example of a weird mobile-network acronym) expands to "Physical channel HybridARQ Indicator Channel"; and then the embedded "ARQ" inside it, purportedly expands to https://en.wikipedia.org/wiki/Automatic_repeat_request https://en.wikipedia.org/wiki/Automatic_repeat_request . Some might claim that the "Q" in "ARQ" is actually "query"; and that people who choose to expand the "Q" as "request" just have a dim view of the average person's vocabulary level. Personally, though, I'd argue that, if you think about it, the "Q" is probably not "request" or "query", but rather just another appearance of the conventional opaque "Q" that appears in https://en.wikipedia.org/wiki/Q_code https://en.wikipedia.org/wiki/Q_code.
  - dylan604 2y ago
    It's up there with the accepted Tx/Rx for transmit and receive.
    - twojacobtwo 2y ago
      I always saw those as parameters for some reason. Transmit(x), Receive(x).
    - hnuser123456 2y ago
      At least "receive" makes more sense for Rx than "prescription"
      - deleted 2y ago
        [deleted]
      - derefr 2y ago
Havoc 2y ago
There are also some 4G dongles with known broken debug modes that can be used to extract info
- jakeogh 2y ago
  Not easy to search for... I found 3G https://github.com/P1sec/LTE_monitor_c2xx https://github.com/P1sec/LTE_monitor_c2xx
  - Havoc 2y ago
    Think I was looking at this one https://github.com/P1sec/QCSuper https://github.com/P1sec/QCSuper I recall researching this and deciding zte mf823 is best bet cause 4g but haven’t actually tried it As for hard to search - it’s pretty murky turf legally in most countries
tonygiorgio 2y ago
Fun stuff, glad to see open source stuff like this still being used. Did downlink eavesdropping in the network security lab at college about 10 years ago. One of my projects was measuring how much cell activity dropped during spring break, another was to do timing attacks on known phone numbers at known locations to see if I can pull temporary IDs (not temporary enough IMO) and do repeat calls to see if they’re still in the area. Makes me want to play with this again.
offmycloud 2y ago
LTESniffer claims to be Open Source but does not appear to have a top-level LICENSE file, nor a GitHub repo license set.
- transpute 2y ago
  Most of the source files have copyright headers indicating that the code is AGPLv3 and forked from existing projects with top-level LICENSE files, https://github.com/falkenber9/falcon https://github.com/falkenber9/falcon and https://github.com/srsran/srsRAN_Project https://github.com/srsran/srsRAN_Project. They should indeed add a top-level LICENSE file to cover the build and other supporting files.
rnhmjoj 2y ago
Only tangentially related, but has anyone ever tried to eavesdrop on DSL? Modern DSL (VDSL2 in particular) is essentially a HF signal guided on an unshielded twisted pair (with line stubs and what not), so it should easily leak out and radiate. Apparently it does so much that radio hamateurs in the UK have been complaining[1] about it a lot. I wonder if the signal can still be demodulated or it's just an annoying baseline on the spectrum. [1]: https://rsgb.services/public/publications/vdsl/measuring_and_reporting_vdsl_radcom_may%202020.pdf https://rsgb.services/public/publications/vdsl/measuring_and...
- rasz 2y ago
  >eavesdrop on DSL? VDSL modem spectrum during synchronization https://www.youtube.com/watch?v=7m8pAuk9lsk https://www.youtube.com/watch?v=7m8pAuk9lsk Adsl2 handshake sound https://www.youtube.com/watch?v=foPGdfsrskA https://www.youtube.com/watch?v=foPGdfsrskA I also remember seeing one with DOCSIS Cable Modem, but cant find it :(
  - rnhmjoj 2y ago
    That seems to be recorded by tapping into the telephone wire, I meant from RFI.
amy-petrik-214 2y ago
The other interesting fact which is lesser known is that earlier G's of digital phone xfer are in what is somewhat a sweet spot of cracking, not very easy at all, but just easy enough to be crackable. But their encryption is breakable! THe rainbow table is 2 TB and took several months to build - https://github.com/0xh4di/GSMDecryption?tab=readme-ov-file https://github.com/0xh4di/GSMDecryption?tab=readme-ov-file Now I wonder if later Gs have a bit of a decryption loophole for this reason or that, this state actor or that.

256 points by transpute 2y ago

Nice! I see that it supports FDD only (no TDD) and is limited to 20MHz, so some limitations. I see that it can do some amount of real-time decoding, which is interesting. In cell towers, a big part of the processing is done by fairly general-purpose processors, but still much more tightly integrated with the hardware than this software is.

wkat4242 2y ago

Too bad the hardware for this is eyewateringly expensive :'(

teruakohatu 2y ago
Seems like if you had a PC already, you could get away with a bladeRF 2.0 micro xA5 for $670, but this can sniff downlink only.
- wkat4242 2y ago
  Yeah for me that is already eye-wateringly expensive :) (Being in Spain where purchasing power is low).
- fhsm 2y ago
  > xA5 for $670 No longer for sale (out of stock with no plan to restock https://www.nuand.com/product/bladerf-xa5/ https://www.nuand.com/product/bladerf-xa5/ )
RachelF 2y ago
Yes, there is cheaper hardware like the Adalm Pluto with enough bandwidth and dynamic range, but it is not supported by the looks of things.
superkuh 2y ago
For those interested in a more accessible LTE meta-data decoder check out https://github.com/JiaoXianjun/LTE-Cell-Scanner https://github.com/JiaoXianjun/LTE-Cell-Scanner which can work with even cheap rtl-sdr dongles (for some things). It is a fork of an older https://github.com/Evrytania/LTE-Cell-Scanner https://github.com/Evrytania/LTE-Cell-Scanner
- wkat4242 2y ago
  Huh how can that work? It's only got 2Mhz bandwidth. An LTE cell is much wider.
  - dezgeg 2y ago
    Possibly it's decoding MIB only, which is only 1.080 MHz wide.
binary_marbl 2y ago
What does it require?
tinix 2y ago
It uses srsRAN which supports SoapySDR which is vendor agnostic. this should work with limesdr as well. for something cheaper, try antsdr or adalm-pluto: https://github.com/srsran/zynq_timestamping https://github.com/srsran/zynq_timestamping lots of good notes here: https://www.quantulum.co.uk/blog/private-lte-with-analog-adalm-pluto/ https://www.quantulum.co.uk/blog/private-lte-with-analog-ada...
- wkat4242 2y ago
  I thought it needs 2xUSRP if you want to receive both sides? And it's a lot less useful without that.
  - AnarchismIsCool 2y ago
    Pluto and USRP are almost exactly the same thing at this point, just USB2 vs USB3 so you're limited on data rates outside of the device an technically a different chip but they're an old node and binned, so they're the same in practice. You can still install an external clock into the UFL connector on the Pluto though so you can sync a few if you want or use a GPSDO for frequency accuracy. You can also install the extra Tx/Rx pair onto the UFL connectors they added recently-ish.
HeatrayEnjoyer 2y ago
True? How are phone modems inexpensive?
- paweladamczuk 2y ago
  I'm wondering the same thing. Can someone outline the architectural limitations of using a smartphone modem for such network debugging/sniffing tasks?
  - wkat4242 2y ago
    Smartphone modems (baseband) are super optimised for battery life. They don't send any traffic that isn't meant for the device itself on to the CPU. That would only cause unnecessary load. They could perhaps be modified to do that but the baseband firmware is usually very closed source. There is only one example I know, there was one particular dumbphone from the 2G era for which the baseband sourcecode was available due to a hack. You could use several (one for uplink and one for downlink) of these with modified firmware to sniff 2G traffic. I forget which model it was exactly but obviously the price ballooned on eBay :) Haven't heard of this happening with later models. Baseband sourcecode firmware is really rare.
    - motrm 2y ago
      Certainly Qualcomm modems can have their diagnostic mode enabled when you have access to /dev/diag - usually on rooted devices but occasionally on stock. You can ask the processor to send higher layer information via diag, including the messages the base stations send. There’s also commands to lock on to a specific base station so you’re not constantly moving from cell to cell. There’s plenty of commercial devices that use this functionality to provide network monitoring and management capabilities for mobile network operators checking out base station functionality in the field. TEMS comes to mind for that but they’re certainly not the only ones. It’s a deep rabbit hole :-)
      - deleted 2y ago
        [deleted]

deleted 2y ago

[deleted]

anilakar 2y ago

Mobile network standards are full of acronyms. I love it. In case you did not know, the letter Q in PHICH stands for "request".

derefr 2y ago
If anyone is wondering what the parent poster is talking about — the abbreviation PHICH (which isn't mentioned in the referenced project, but is just an example of a weird mobile-network acronym) expands to "Physical channel HybridARQ Indicator Channel"; and then the embedded "ARQ" inside it, purportedly expands to https://en.wikipedia.org/wiki/Automatic_repeat_request https://en.wikipedia.org/wiki/Automatic_repeat_request . Some might claim that the "Q" in "ARQ" is actually "query"; and that people who choose to expand the "Q" as "request" just have a dim view of the average person's vocabulary level. Personally, though, I'd argue that, if you think about it, the "Q" is probably not "request" or "query", but rather just another appearance of the conventional opaque "Q" that appears in https://en.wikipedia.org/wiki/Q_code https://en.wikipedia.org/wiki/Q_code.
- dylan604 2y ago
  It's up there with the accepted Tx/Rx for transmit and receive.
  - twojacobtwo 2y ago
    I always saw those as parameters for some reason. Transmit(x), Receive(x).
  - hnuser123456 2y ago
    At least "receive" makes more sense for Rx than "prescription"
    - deleted 2y ago
      [deleted]
    - derefr 2y ago

Havoc 2y ago

There are also some 4G dongles with known broken debug modes that can be used to extract info

jakeogh 2y ago
Not easy to search for... I found 3G https://github.com/P1sec/LTE_monitor_c2xx https://github.com/P1sec/LTE_monitor_c2xx
- Havoc 2y ago
  Think I was looking at this one https://github.com/P1sec/QCSuper https://github.com/P1sec/QCSuper I recall researching this and deciding zte mf823 is best bet cause 4g but haven’t actually tried it As for hard to search - it’s pretty murky turf legally in most countries

tonygiorgio 2y ago

Fun stuff, glad to see open source stuff like this still being used. Did downlink eavesdropping in the network security lab at college about 10 years ago. One of my projects was measuring how much cell activity dropped during spring break, another was to do timing attacks on known phone numbers at known locations to see if I can pull temporary IDs (not temporary enough IMO) and do repeat calls to see if they’re still in the area. Makes me want to play with this again.

offmycloud 2y ago

LTESniffer claims to be Open Source but does not appear to have a top-level LICENSE file, nor a GitHub repo license set.

transpute 2y ago
Most of the source files have copyright headers indicating that the code is AGPLv3 and forked from existing projects with top-level LICENSE files, https://github.com/falkenber9/falcon https://github.com/falkenber9/falcon and https://github.com/srsran/srsRAN_Project https://github.com/srsran/srsRAN_Project. They should indeed add a top-level LICENSE file to cover the build and other supporting files.

rnhmjoj 2y ago

Only tangentially related, but has anyone ever tried to eavesdrop on DSL? Modern DSL (VDSL2 in particular) is essentially a HF signal guided on an unshielded twisted pair (with line stubs and what not), so it should easily leak out and radiate. Apparently it does so much that radio hamateurs in the UK have been complaining[1] about it a lot. I wonder if the signal can still be demodulated or it's just an annoying baseline on the spectrum. [1]: https://rsgb.services/public/publications/vdsl/measuring_and_reporting_vdsl_radcom_may%202020.pdf https://rsgb.services/public/publications/vdsl/measuring_and...

rasz 2y ago
>eavesdrop on DSL? VDSL modem spectrum during synchronization https://www.youtube.com/watch?v=7m8pAuk9lsk https://www.youtube.com/watch?v=7m8pAuk9lsk Adsl2 handshake sound https://www.youtube.com/watch?v=foPGdfsrskA https://www.youtube.com/watch?v=foPGdfsrskA I also remember seeing one with DOCSIS Cable Modem, but cant find it :(
- rnhmjoj 2y ago
  That seems to be recorded by tapping into the telephone wire, I meant from RFI.

amy-petrik-214 2y ago

The other interesting fact which is lesser known is that earlier G's of digital phone xfer are in what is somewhat a sweet spot of cracking, not very easy at all, but just easy enough to be crackable. But their encryption is breakable! THe rainbow table is 2 TB and took several months to build - https://github.com/0xh4di/GSMDecryption?tab=readme-ov-file https://github.com/0xh4di/GSMDecryption?tab=readme-ov-file Now I wonder if later Gs have a bit of a decryption loophole for this reason or that, this state actor or that.